Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 05:11
Static task
static1
Behavioral task
behavioral1
Sample
8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe
Resource
win10-en-20211208
General
-
Target
8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe
-
Size
2.8MB
-
MD5
4cf6cc9fafde5d516be35f73615d3f00
-
SHA1
f4b9c366a50fa20013d70730f9e260534e59a846
-
SHA256
8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56
-
SHA512
f9670cbda474606b17302fab11dc5e5fff1ecf1414454f30293a5650e4e4458d6f687e642f4f8b5c154b5619382fd06a043517ffc5d1ffc0d5344fc3b3763a05
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exedescription ioc process File opened for modification \??\PhysicalDrive0 8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe -
Modifies registry class 4 IoCs
Processes:
8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\ = "ItemMoniker" 8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\InprocServer32 8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\InprocServer32\ = "ole32.dll" 8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048} 8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exedescription pid process Token: 33 1212 8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe Token: SeIncBasePriorityPrivilege 1212 8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exepid process 1212 8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe 1212 8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe"C:\Users\Admin\AppData\Local\Temp\8f236ac211c340f43568e545f40c31b5feed78bdf178f13abe498a1f24557d56.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1212-54-0x0000000076001000-0x0000000076003000-memory.dmpFilesize
8KB
-
memory/1212-55-0x00000000026B0000-0x00000000028BC000-memory.dmpFilesize
2.0MB
-
memory/1212-59-0x0000000000400000-0x000000000086F000-memory.dmpFilesize
4.4MB
-
memory/1212-60-0x0000000000400000-0x000000000086F000-memory.dmpFilesize
4.4MB
-
memory/1212-61-0x0000000000400000-0x000000000086F000-memory.dmpFilesize
4.4MB
-
memory/1212-62-0x0000000003600000-0x00000000036BA000-memory.dmpFilesize
744KB